• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Anomalous Single Factor Signin

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•3•0•66

    'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal. Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'

    Microsoft Sentinel (KQL)

    Tags

    T1078.004 - Cloud AccountsTA0001 - Initial AccessTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationT1556.006 - Multi-Factor AuthenticationT1586 - Compromise AccountsT1586.003 - Cloud AccountsTA0006 - Credential AccessTA0042 - Resource DevelopmentT1111 - Multi-Factor Authentication InterceptionAuthentication AttemptAuthentication SuccessAuthentication FailureMultifactor Authentication BypassLogon EventUser Account ModifiedAdmin ActivityApplication EventAzureAzure Signin LogsAzure Ad Risk DetectionkqlAADSecOpsGuidetactic:InitialAccesstechnique:T1078.004

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?